Integrating service appliances without source network address translation in networks with logical overlays

Abstract

A network controller for a network implementing a virtual network overlay determines a network gateway via which a service appliance accesses the network. The network controller determines a network gateway via which an application server accesses the network. First policy data is distributed to the network gateway via which the service appliance accesses the network. This first policy data indicates that the network gateway via which the service appliance accesses the network forwards return packets addressed to a client device sent from an application server to the service appliance. Second policy data is distributed to the network gateway via which the application server accesses the network. This second policy data indicates the network gateway via which the application server accesses the network is configured to forward return packets addressed to the client device to the network gateway via which the service appliance accesses the network.

What is claimed is: 
     
       1. A method comprising:
 determining, at a network controller for a network implementing a virtual network overlay, a network gateway via which a stateful service appliance accesses the network; 
 determining, at the network controller, a network gateway via which an application server accesses the network; 
 distributing first policy data from the network controller to the network gateway via which the stateful service appliance accesses the network, the first policy data indicating a network policy that when executed causes the network gateway via which the stateful service appliance accesses the network to forward return packets addressed to a client device sent from the application server to the stateful service appliance; and 
 distributing second policy data from the network controller to the network gateway via which the application server accesses the network, the second policy data indicating a network policy that when executed causes the network gateway via which the application server accesses the network to forward the return packets to the network gateway via which the stateful service appliance accesses the network, 
 wherein the network gateway via which the application server accesses the network is different from the network gateway via which the stateful service appliance accesses the network, 
 wherein the network gateway via which the stateful service appliance accesses the network is different from a network gateway via which the client device accesses the network, and 
 wherein the network gateway via which the application server accesses the network and the network gateway via which the stateful service appliance accesses the network comprise a distributed network gateway that implements the virtual network overlay. 
 
     
     
       2. The method of  claim 1 , wherein the stateful service appliance comprises a load balancer. 
     
     
       3. The method of  claim 1 , wherein
 the stateful service appliance comprises a first service appliance of a plurality of service appliances. 
 
     
     
       4. The method of  claim 3 , wherein distributing the first policy data from the network controller to the network gateway via which the stateful service appliance accesses the network comprises distributing the first policy data to each gateway of the distributed network gateway via which each of the plurality of service appliances accesses the network. 
     
     
       5. The method of  claim 1 , wherein the application server is one of a plurality of application servers, wherein each of the plurality of application servers provides a same application functionality; and
 wherein distributing the second policy data from the network controller to the network gateway via which the application server accesses the network comprises distributing the second policy data to each network gateway via which one or more of the plurality of applications servers access the network. 
 
     
     
       6. The method of  claim 1 , wherein the network gateway via which the stateful service appliance accesses the network and the network gateway via which the application server accesses the network are different leaf switches. 
     
     
       7. The method of  claim 1 , wherein the return packets comprise a response to an application service request from the client device. 
     
     
       8. An apparatus comprising:
 a network interface configured to communicate over a network implementing a virtual network overlay; and 
 one or more processors, wherein the one or more processors are configured to:
 determine a network gateway via which a stateful service appliance accesses the network; 
 determine a network gateway via which an application server accesses the network; 
 distribute, via the network interface, first policy data from the apparatus to the network gateway via which the stateful service appliance accesses the network, the first policy data indicating a network policy that when executed causes the network gateway via which the stateful service appliance accesses the network to forward return packets addressed to a client device sent from the application server to the stateful service appliance; and 
 distribute, via the network interface, second policy data from the apparatus to the network gateway via which the application server accesses the network, the second policy data indicating a network policy that when executed causes the network gateway via which the application server accesses the network to forward the return packets to the network gateway via which the stateful service appliance accesses the network, 
 wherein the network gateway via which the application server accesses the network is different from the network gateway via which the stateful service appliance accesses the network, 
 wherein the network gateway via which the stateful service appliance accesses the network is different from a network gateway via which the client device accesses the network, and 
 wherein the network gateway via which the application server accesses the network and the network gateway via which the stateful service appliance accesses the network comprise a distributed network gateway that implements the virtual network overlay. 
 
 
     
     
       9. The apparatus of  claim 8 , wherein the stateful service appliance comprises a load balancer. 
     
     
       10. The apparatus of  claim 8 , wherein
 the stateful service appliance comprises a first service appliance of a plurality of service appliances. 
 
     
     
       11. The apparatus of  claim 10 , wherein the one or more processors are further configured to distribute the first policy data from the apparatus to the network gateway via which the stateful service appliance accesses the network by distributing the first policy data to each gateway of the distributed network gateway via which each of the plurality of service appliances accesses the network. 
     
     
       12. The apparatus of  claim 8 , wherein the application server is one of a plurality of application servers, wherein each of the plurality of application servers provides a same application functionality; and
 wherein the one or more processors are further configured to distribute the second policy data from the apparatus to the network gateway via which the application server accesses the network by distributing the second policy data to each network gateway via which one or more of the plurality of applications servers access the network. 
 
     
     
       13. The apparatus of  claim 8 , wherein the network gateway via which the stateful service appliance accesses the network and the network gateway via which the application server accesses the network are different leaf switches. 
     
     
       14. The apparatus of  claim 8 , wherein the return packets comprise a response to an application service request from the client device. 
     
     
       15. A non-transitory computer readable storage medium encoded with instructions, wherein the instructions, when executed by a processor, cause the processor to:
 determine, at a network controller for a network implementing a virtual network overlay, a network gateway via which a stateful service appliance accesses the network; 
 determine, at the network controller, a network gateway via which an application server accesses the network; 
 distribute first policy data from the network controller to the network gateway via which the stateful service appliance accesses the network, the first policy data indicating a network policy that when executed causes the network gateway via which the stateful service appliance accesses the network to forward return packets addressed to a client device sent from the application server to the stateful service appliance; and 
 distribute second policy data from the network controller to the network gateway via which the application server accesses the network, the second policy data indicating a network policy that when executed causes the network gateway via which the application server accesses the network to forward the return packets to the network gateway via which the stateful service appliance accesses the network, 
 wherein the network gateway via which the application server accesses the network is different from the network gateway via which the stateful service appliance accesses the network, 
 wherein the network gateway via which the stateful service appliance accesses the network is different from a network gateway via which the client device accesses the network, and 
 wherein the network gateway via which the application server accesses the network and the network gateway via which the stateful service appliance accesses the network comprise a distributed network gateway that implements the virtual network overlay. 
 
     
     
       16. The non-transitory computer readable storage medium of  claim 15 , wherein the stateful service appliance comprises a load balancer. 
     
     
       17. The non-transitory computer readable storage medium of  claim 15 , wherein
 the stateful service appliance comprises a first service appliance of a plurality of service appliances. 
 
     
     
       18. The non-transitory computer readable storage medium of  claim 17 , wherein the instructions that cause the processor to distribute the first policy data from the network controller to the network gateway via which the stateful service appliance accesses the network further cause the processor to distribute the first policy data to each gateway of the distributed network gateway via which each of the plurality of service appliance accesses the network. 
     
     
       19. The non-transitory computer readable storage medium of  claim 15 , wherein the application server is one of a plurality of application servers, wherein each of the plurality of application servers provides a same application functionality; and
 wherein the instructions that cause the processor to distribute the second policy data from the network controller to the network gateway via which the application server accesses the network further cause the processor to distribute the second policy data to each network gateway via which one or more of the plurality of applications servers access the network. 
 
     
     
       20. The non-transitory computer readable storage medium of  claim 15 , wherein the network gateway via which the stateful service appliance accesses the network and the network gateway via which the application server accesses the network are different leaf switches.